From patchwork Wed Nov 11 15:11:53 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10721 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4jPn764H6cz3wh2 for ; Wed, 11 Nov 2026 15:12:02 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE2" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4jPn761pVNz4gj for ; Wed, 11 Nov 2026 15:12:02 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4jPn760vcRz2yVL for ; Wed, 11 Nov 2026 15:12:02 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4jPn7149wFz2xMg for ; Wed, 11 Nov 2026 15:11:57 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4jPn701DT1zBn; Wed, 11 Nov 2026 15:11:56 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1794409916; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=tTT4LES3WrynB6WPKUotrh/6jJvMDRSZW/3MB0S9Rxk=; b=eon0pjcibh4M1sYEGu8SjwgHmxTMWaXxalaYE3n4I1rnvYFrgr/JOziGfiE4jtbqOkOMGZ CYkTt4YSNSOTVZAQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1794409916; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=tTT4LES3WrynB6WPKUotrh/6jJvMDRSZW/3MB0S9Rxk=; b=EVGX452lwLAFIlwAemovV957/J8ggR44qZzTUubECs7aQsa0OELyK+Yn7+NG/ie4RQS0N7 0PxU4gKFzxrhDsFu3Jry5zHpAXDQmYBabq23/DhAVE7dJlVcE9d43/un08GZWlczl7zsA6 HKeC2l/oWfHjCxEjfjE6+VzRG58VaudWvZGHrUULN69+DA4jZYkrdsxN+vlzX9WcaxZOHS 472NVca2//rBBWU6nPG5/Ad7lcGNpC/bAJXI+eOgRuOty29ggWy1mx+4jD6Bqja/LjMlZy In6VhIy6bgZVS2iPi6O5w9gQggpDEIF2MJNHrblovGp/pS77RNsSOMeUphfdDw== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] haproxy: Update to version 3.4.7 Date: Wed, 11 Nov 2026 16:11:53 +0100 Message-ID: <20261111151153.2079397-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 3.4.3 to 3.4.7 - No change in rootfile - 2 CVE fixes in version 3.4.4 and 2 in 3.4.7 but the number has not yet been assigned. - Changelog 3.4.7 This release contains two important security fixes, in addition to the usual set of bug fixes. The first one concerns the HTTP/2 multiplexer, where a truncated PING frame could prevent the CPU from going back to idle, and the second one the HTTP/1 parser, where a chunked request with a too long chunk-size line could lead to the same behavior. CVEs were requested for both. The rest of the release fixes issues in the configuration parser, the muxes (H1, H2 and FCGI), the CLI, the syslog applet used by "log-forward", the stick-table key exchange over peers, maps/ACLs, and AWS-LC builds of the SSL layer. Two behaviour changes deserve attention: the "none" JWT algorithm is now rejected by default, and server-sent event responses (SSE) no longer suffer from Nagle-induced delays. * mux-h2: A truncated PING frame could waste the CPU of spurious wakeups. An HTTP/2 PING frame cannot be entirely consumed until it is complete, and the presence of an incomplete frame is sufficient to cause a wakeup, preventing the CPU from going idle until the entire frame is received, and resulting in a 100% CPU measurement for as long as the peer keeps the connection open without completing the frame (or until "timeout http-request" expired, when one is set). The performance impact is moderate and depends on the ratio of such connections among all concurrent connections. Partial PING frames are now detected as short reads like the other frame types, so the tasklet goes back to sleep until the rest of the frame arrives. The handling of short reads was fixed in 2.5, but PING was missed; it only became a problem in 3.1 when the tasklet wake-up logic changed. As a workaround on an older build, setting "timeout http-request" to a low value such as 1-5 seconds limits the CPU consumption. * h1-htx: A too long chunk-size line waste the CPU of spurious wakeups. For chunked messages, when a chunk-size line was longer than the input buffer, the parser made no progress, waiting for the end of the line. So no data was consumed, the buffer was full and could not be extended: the same bytes were retried endlessly with no request ever processed on it, preventing, as for the H2 multiplexer issue, the CPU from going idle. Here too, the impact is moderate and depends on the ratio of such connections among all concurrent connections. A parsing error (HTTP 400) is now reported as soon as the parser determines that the line cannot possibly fit, using the same full-buffer detection that already exists for oversized headers and trailers. Reported with a fix proposal by Adam Crawford. * cfgparse: Several configuration parsing issues were fixed, one of which could randomly prevent startup. The most severe one concerns the "userlist" section. Its internal section identifier overlapped with the "global" and "listen" ones, so depending on build options and the linker, the wrong parser could be invoked for the "user" and "group" keywords. A configuration that was accepted by one build could then fail to start on another with errors such as "cannot find group id for 'admins'", with no configuration-side workaround. A backend section given extra arguments after its name (e.g. "backend b junk") was silently ignored when it was the last section of the file; it is now properly rejected with a clear message. The "email-alert" options now really check that a value was provided, the proxy "description" keyword no longer leaks the previous string when used twice, the global "description" allocation is checked, and "max-spread-checks" no longer stores an uninitialized value on a parse error. The warning printed for conflicting ACL conditions no longer emits a stray quote on the next line. Also, setting "localpeer" in the global section while passing "-L" on the command line used to make HAProxy refuse to load its configuration as a fatal error; it is now a warning again as documented, and the name from "-L" wins, so instances sharing a configuration file start again. Finally, the list of suggested options used when one is mistyped was completed and fixed. * cli: A command line filling the buffer exactly could loop forever. Since the pipelining refactor, the last command of a line is detected by comparing its end with the tail of an internal buffer. When a command line (including its final LF) was exactly "tune.bufsize" bytes long, the tail wrapped and the last command was never detected: its words were then re-parsed as new commands, the buffer length underflowed, and the CLI kept answering "Unknown command" errors, keeping a thread busy as long as the client read them. With DEBUG_STRICT=2, HAProxy crashed instead. Reported and fixed by Yeonggi Kim. * log: Syslog sessions in "log-forward" sections never ended. The syslog applet stopped reading its input as soon as the buffer was empty, which was also where the client's shutdown was noticed. When a client closed the connection after its last message had been forwarded, the session stayed open forever. A "log-forward" section does not inherit "timeout client" from the defaults section, so without an explicit timeout nothing ever closed these sessions: they accumulated, and a soft-stop then waited for "hard-stop-after" (forever if it is not set). This also happened when a "ring" forwarded to a local "log-forward" section, causing the previous process to survive a reload. Sessions now end correctly on client close and are accounted in "cli_aborts" as before. Reported and fixed by Yeonggi Kim. * stick-table: Oversized keys could corrupt memory when replicated to peers. The overhead and the stored data were not accounted for when building the key sent over the peers protocol, although the whole message must fit in one buffer. A key close to the buffer size could therefore crash the sender, or overwrite a few bytes past the end of the buffer: this is reachable by tracking a large body or by applying an expansion converter (b64dec, hex, ...) to a key, or more easily with binary keys, which are always sent fully padded. Keys are now sized against the available room: string keys are trimmed, and binary keys too large to fit are refused at configuration time with an explicit message. There is no protocol change, so mixed-version peers still interoperate; realistic configurations are unaffected. Reported with a reproducer by Dmitri Kaslov. A stick-table counter was also fixed: the number of trackers returned by "table_trackers()" no longer counts the lookup itself, in line with the other fetches. * map/acl: A use-after-free could be triggered with maps and ACLs. When a lookup succeeded through the tree without filling the result (the case of ACL matches), the returned sample still pointed at data left over by an earlier lookup done on the same thread outside the normal path, e.g. by the CLI's "get map" command. If that element was then freed ("del map", "clear map", or the old generation purged after "commit map"), the next matching request read freed memory, leading to random behaviour or a worker crash. Configurations using both an ACL and a map loaded from a virtual file are concerned. The returned pattern is no longer touched when it is not filled. * tcpcheck: A crash was possible with "tcp-check expect rstring". The rule could be evaluated while the check's input buffer was not yet allocated, passing a NULL buffer to the regular expression engine, which expects a writable one. Only builds using the libc regex were affected (PCRE/PCRE2 and the binary case return cleanly). Such a rule now simply reports no match, like the string and binary cases already did. * listener: A stuck accept loop could trigger the watchdog. Listeners were woken up without checking whether "maxconn" had already been reached. With many thread groups, a group could dequeue listeners, fail to accept because another group had consumed the last slots, and remain stuck long enough to trip the watchdog. * ssl: Cipher and curve restrictions of crt-list lines were ignored with AWS-LC, and a few crashes were fixed. On AWS-LC builds, the SSL object keeps its own copy of the cipher lists and curves taken at creation, and switching to the certificate's SSL_CTX during the handshake did not refresh them. As a result, the "ciphers", "ciphersuites", "curves" and "ecdhe" options of a crt-list line were silently ignored, and a client could negotiate a cipher or a curve that the certificate explicitly excluded, as long as the bind line allowed it. These settings are now reapplied after the context switch (OpenSSL builds were not affected). In addition, "dump ssl cert" could crash on AWS-LC when a certificate in crt-store had no private key. Two crashes in the SSL I/O callback could also be hit when traces were enabled and a connection was destroyed instead of being returned to an idle pool or its session. Finally, X25519 and X448 are now reported under their standard IANA names in traces, and "curves2nid()" can resolve them; the old "ecdh_x25519"/"ecdh_x448" spellings are kept as aliases. * muxes: Several crashes and connection-handling bugs were fixed in the H1, H2 and FCGI multiplexers. A connection upgraded from HTTP/1 to HTTP/2 (via the H2 connection preface) is only allowed to do so on its very first request, but the check was defeated when the preface of a later request arrived split across several reads: the connection could then be switched to H2 in the middle of its life, dropping the end of the previous response that was still pending in the output buffer. The first-request condition is now checked reliably. Other fixes in this area: when the H2 multiplexer could not allocate a buffer to receive a large request body (with "tune.buffers.limit" for instance), it could crash while switching buffers; the reverse HTTP gateway ("rhttp@") could crash when an outgoing H2 connection failed, because the failure was not reported to the caller that then used a freed connection (an experimental feature); the H2 and FCGI multiplexers could return a pointer to an already freed tasklet when a deferred shutdown was scheduled, and the H1 multiplexer passed an upgraded (thus no longer valid) connection to the traces when destroying a stream. Also, when an error page (400, 408, 500, 501) was mapped to an empty file or /dev/null, the H1 multiplexer failed to release its embryonic stream, so the connection stayed open until the client timeout instead of being closed immediately. * h3/quic/hq-interop: Several protocol robustness issues were fixed. HTTP/3 frames whose header itself was truncated are now rejected with H3_FRAME_ERROR, closing the connection immediately instead of leaving the stream to time out; a GOAWAY frame whose length does not match its single stream ID is likewise a connection error. A peer that resets (RESET_STREAM) its QPACK encoder or decoder stream is now detected as a critical-stream violation, like a close with FIN already was. In the QUIC transport, a STREAM frame that sets FIN before the already-received offset is now rejected with FINAL_SIZE_ERROR even when the final size is not yet known. The HTTP/0.9 parser no longer sets the end-of-message flag twice when the final FIN arrives in its own empty frame, which could trip an internal consistency check. Finally, the QUIC stack now implements the AEAD integrity limit required by RFC 9001 ยง6.6: failed packet authentications are counted per connection and the connection is closed with AEAD_LIMIT_REACHED once the limit of the cipher is exceeded (2^52 for AES-GCM, 2^36 for ChaCha20-Poly1305). This is a hardening measure with no practical impact. * flt-http-comp: The compression filter could truncate a message. Since the filter produces a new payload and may hold data in its own context, the end-of-message flag now stays cleared on the HTX message until the compression is really complete, instead of being visible while data is still buffered in the filter. Otherwise a message with no input left and the EOM flag set was considered complete and the remaining compressed data could be dropped, truncating the response. * jwt: Tokens using the "none" algorithm are now rejected by default. Following RFC 8725, "jwt_verify" no longer accepts an unsigned token whose algorithm is "none" unless the caller explicitly allows it. If some of your checks rely on such tokens, they will now fail and you must add the new global directive "jwt.allow_none_alg" to restore the previous behaviour. * jwe: Two buffer overflows were fixed in the RSA1.5 decryption path. Found by Dmitri Kaslov. * http-ana: SSE responses are no longer delayed, and "option checkcache" now returns a 502. Responses advertising "Content-Type: text/event-stream" now automatically have the equivalent of "option http-no-delay" enabled for the direction towards the client, forwarding this way small events immediately instead of dealying them by up to ~200 ms. Independently, when "option checkcache" blocked a response, the status returned to the client was still the server's original one (usually 200) instead of the 502 bad gateway that the documentation promises and that "http-response deny" produces; the error files are now used as well. * samples: Several converters and fetches returned wrong results. Time converters ("ms_ltime", "ms_utime", "us_ltime", "us_utime") applied their offset in the wrong unit, "http_date()" did not zero-pad the sub-second part ("23 ms" printed as ".23", same as "23 us"), the JWT part queries failed without a path, "quic_enabled()" and "req.ssl_ec_ext" failed instead of returning false, "res.cook_cnt()" miscounted Set-Cookie attributes, TCP-mode fetches exposed the ":method"/":path" pseudo-headers, and "language" skipped values after a truncated q-factor. All were fixed. * spoe/stconn/proxy/hlua: A few internal robustness fixes. Adding a backend at runtime through the CLI did not set the load-balancing capability on it, which is only used today to validate a server's compatibility with the proxy's mode and could matter later. A SPOE agent configuration file that defines no "spoe-message" section corrupted the agent's message list during parsing, which could break the agent's messages; the list is now spliced correctly. Streams caught in the middle of a connection retry could crash the process while being dumped by "show threads", the watchdog or "warn-blocked-traffic-after"; endpoints are now replaced instead of being briefly detached, so an observer can never see a stream without endpoint. Finally, a Lua event handler looking up a server could hit a race with dynamic backends: if the backend was removed between the event being queued and processed, an internal consistency check killed the process. The lookup now tolerates a gone backend. * doc: The documentation was corrected on several points. The "url_ip" and "url_port" fetches are now documented as failing when the authority part contains a host name rather than an address. The "hex2i" converter is documented as failing (returning nothing) on unparsable input instead of returning zero. "option checkcache" now mentions that responses carrying neither a validator nor freshness information are not examined and pass unfiltered. The diagnostic mode section explains that some diagnostic messages interact with "zero-warning" mode (and thus must only be used interactively). Finally, the "log-steps" parser error message now states the comma-separated syntax it actually expects. * build: The "haring" developer tool no longer fails to build on a warning. A statement with no effect (and a static variable that was never set) made the "haring" tool emit a build warning, and prevented it from building where warnings are treated as errors. Complete changelog (includes above entries) : BUG/MINOR: proxy: add PR_CAP_LB for dynamically added backend BUG/MINOR: server: fix "del server" description BUG/MINOR: cli: update wait help usage BUG/MINOR: hq-interop: prevent double EOM on request with standalone FIN BUG/MINOR: ssl: fix trace crash on FE conn release in io cb BUG/MINOR: ssl: fix trace crash on BE conn release in io cb BUG/MINOR: mux_quic: extend FINAL_SIZE_ERROR detection on stream BUG/MINOR: h3: reject frames with truncated header BUG/MINOR: h3: close connection on GOAWAY frame too long BUG/MINOR: h3: reject RS/SS for QPACK uni streams BUG/MINOR: log: fix erroneous error message in log-steps parser BUG/MINOR: hlua: assume proxy_find_by_id() may return NULL on previously existing server BUG/MEDIUM: flt-http-comp: Block HTX_FL_EOM flag till the end of compression BUG/MINOR: flt-http-comp: Rely on htx_set_eom() to restore EOM flag BUG/MINOR: spoe: Fix the message list splice with an empty list BUG/MEDIUM: mux-h1: also release the embryonic stream when the error is empty BUG/MINOR: http-fetch: don't report pseudo-headers in TCP mode BUG/MEDIUM: mux-h1: only accept the H2 preface on the first request REGTESTS: http-messaging: Fix http_fail_cnt_body to succeed with small timeouts BUG/MAJOR: h1-htx: report an error on a too long chunk-size line BUILD: haring: fix compile issue due to nop warning. MINOR: quic: implement the AEAD integrity limit BUG/MEDIUM: ssl: crt-list ciphers ignored with AWS-LC BUG/MEDIUM: ssl: crt-list curves ignored with AWS-LC MINOR: doc: elaborate on diagnostic mode behavior BUG/MEDIUM: listener: Consider maxconn before waking listeners MEDIUM: jwt: Reject "none" alg in jwt_verify by default BUG/MINOR: jwe: Buffer overflow when filling fake cek in case of RSA1.5 BUG/MINOR: jwe: Avoid buffer overflow in fake cek (RSA1.5) BUG/MINOR: ssl: Fix potential NULL-deref in "dump ssl cert" with AWS-LC BUG/MINOR: ssl: use standard names for X25519 and X448 groups REGTEST: ssl: require OpenSSL 1.1.1 for crt-list ciphersuites tests BUG/MINOR: cfgparse-global: only warn when "localpeer" is set together with -L MINOR: stconn: prefer to replace endpoints rather than detaching them MINOR: stick-table: provide a function to estimate on-wire data size MINOR: stick-table: calculate the on-wire size of each key BUG/MEDIUM: stick-table: restrict key sizes to what fits in a buffer BUG/MEDIUM: pattern: don't dereference static_pattern's data when not filling it BUG/MINOR: http: do not consume the delimiter of a truncated q-factor BUG/MINOR: sample: apply the ms_/us_ time offsets in the input unit BUG/MINOR: sample: zero-pad the fractional part emitted by http_date() BUG/MINOR: sample: make quic_enabled() always succeed BUG/MINOR: http-ana: return a 502 when checkcache blocks a response BUG/MINOR: stick-table: do not count the lookup itself in table_trackers() BUG/MINOR: payload: always report a boolean from req.ssl_ec_ext BUG/MINOR: http-fetch: do not count Set-Cookie attributes as cookies BUG/MEDIUM: tcpcheck: do not run a regex on an unallocated buffer BUG/MINOR: sample: return the decoded JWT part when no path is given DOC: config: mention other responses not blocked by option checkcache DOC: config: fix doc for hex2i() converter on unparsable input DOC: config: mention that url_ip and url_port fail when passed a name MINOR: http-ana: automatically enable http-no-delay for streaming events (SSE) BUG/MAJOR: cfgparse: properly check userlist section when scanning keywords BUG/MINOR: cfgparse-global: add missing gotos to error label in max-spread-checks BUG/MINOR: cfgparse-global: add missing calloc() check for the global description BUG/MINOR: cfgparse-listen: release the previous description of the proxy BUG/MINOR: cfgparse-listen: fix the argument checked by "email-alert" BUG/MINOR: cfgparse-listen: fix quoting of the condition conflict warning BUG/MINOR: cfgparse-listen: properly reject extra args in a backend section BUG/MINOR: proxy: also look for the closest option among cfg_opts3 BUG/MINOR: cfgparse-listen: complete the list of options for the suggestions BUG/MEDIUM: mux-h2: don't return a freed tasklet from h2_deferred_shut() BUG/MEDIUM: mux-fcgi: don't return a freed tasklet from fcgi_deferred_shut() BUG/MEDIUM: mux-h1: don't pass an upgraded connection to traces in h1s_destroy() BUG/MEDIUM: mux-h2: report a dead rhttp connection in h2_wake() BUG/MEDIUM: mux-h2: fix a possible crash on rxbuf allocation failure BUG/MAJOR: mux-h2: properly handle short reads on PING frames BUG/MEDIUM: cli: fix the last command detection on a full command line REGTESTS: cli: test a command line of exactly tune.bufsize bytes BUG/MEDIUM: log: do not ignore the peer's shutdown in the syslog applet REGTESTS: log: check that a log-forward TCP session ends on client close 3.4.6 This new version is out a few days after the previous one, to correct a major regression introduced in the QUIC stack. This regression was introduced by a change to RESET_STREAM frame reception in the MUX layer. The objective was to ensure the proper release of the related MUX stream once a RESET_STREAM frame has been handled. Without it, there was a risk of preventing the connection from closing, even after the QUIC idle timeout fired, resulting in a connection leak. However, the fix was poorly written and it could have caused a process crash. Thus, this release includes the latest patch in QUIC MUX, which prevents crashes on RESET_STREAM reception while still addressing the original leak issue. Aside from this change, JSON log encoding has been extended as well. The previous point release ensured that the "+json" log format encoding would always produce valid ASCII printable characters. This is particularly important when dumping external inputs, to prevent an attacker from messing with the resulting log lines. However, this may clutter log files for admins who rely on UTF-8 printable values. Thus, a new "+utf8" encoding is now supported as well, so that such characters can be passed through as-is. Here is an example of how to combine these two flags. log-format "%{+json,+utf8}o %(request)r %(custom_expr)[str(custom)]" Ring server reconnection was faulty when an issue occurred on a connection that had been up for more than 24.85 days. This has been present since the introduction of the 1-second delay between retries. It now works as expected, using the last connection closing date instead of the creation date, which could cause a wrap-around of the 32-bit timer. Finally, still related to rings, the last change fixes their configuration. The parser again supports a server definition using a UNIX socket address, which was previously incorrectly rejected during parsing. Conversely, a datagram-based ring server was accepted but would result in a segfault at runtime. This is now rejected by the parser, as expected. That's it for the current release. For users running the previous version who have active QUIC listeners in their configuration, an upgrade must be conducted as soon as possible. If that is not possible, ensure that QUIC listeners are disabled by using the following global statement. tune.quic.listen off This can be turned back on once the upgrade is done. Our apologies to our users and packagers for any inconvenience caused. Thanks to everyone who contributed to this release, with a special mention to the users who quickly reported the QUIC issue and tested the new fix so that this version could be published. Complete changelog (including above entries): BUG/MAJOR: mux_quic: fix potential crash on RESET_STREAM receive BUG/MEDIUM: sink: reconnect attempt not working after session lasted more than ~25 days MINOR: log: pass the input end to the _lf_encode_bytes() byte encoders MINOR: log: add the +utf8 encoding option to let valid UTF-8 pass BUG/MEDIUM: server: skip log backend addr checks for internal proxies REGTESTS: log: check that a ring's internal server may target a UNIX socket 3.4.5 This release fixes a number of bugs in the HTTP/3 and QUIC stacks, in the HTTP message processing, in the Lua integration and in the internal HTTP client used by the ACME and OCSP features, along with several smaller fixes and two performance improvements. * h3: Truncated HTTP/3 frames are now rejected. HTTP/3 connections are now rejected when a stream ends before all the bytes announced in a frame have arrived. Previously, an incomplete frame could be accepted, creating a risk of request-content smuggling when the request was forwarded. This is an important fix for deployments accepting HTTP/3 traffic. This issue was reported by Rajat Raghav. In relation to this issue, the H1 multiplexer was hardened so that an incomplete message can never be emitted to a server as a complete one: trailers are no longer sent while the last chunk is unfinished, and a connection on which the message body was not fully sent is now always closed instead of being reused, whether the body was announced with a Content-Length or chunked. * quic: Connection and stream leaks on QUIC frontends were fixed. Two issues could prevent QUIC connections from being properly released. A client sending a RESET_STREAM frame as the very first frame of a stream left that stream half-closed and accounted forever: stream instances accumulated in memory for the whole lifetime of the connection, and the connection itself could refuse to close even after the idle timeout had expired. Such streams are now closed and purged immediately. Second, the connection timeout was only armed once the first bytes were received, so a connection on which nothing was ever received had no timeout at all and could linger indefinitely. "timeout client" is now armed from connection initialization, which guarantees that idle connections are always closed as expected, and further reduces the risk of leaked connections, including the case above. * h3/qpack: Several stalled transfers and compliance issues were fixed. A transfer ending with an empty DATA frame, empty trailers, or an unknown extension frame could wait until timeout instead of completing. These cases now correctly signal the end of the message. Invalid empty headers and certain control frames missing their mandatory payload are also handled according to the protocol. HTTP/3 header-compression control streams now release the space occupied by data already processed, rather than becoming permanently stalled. Invalid references to an unsupported dynamic compression table are also rejected more strictly. Finally, HTTP/3 frame counters no longer count a large frame several times just because it arrived in multiple pieces, making the reported statistics more reliable. * quic: More robust key updates and error recovery. A failed memory allocation during a key update could cause a worker crash on a subsequent key-phase change. HAProxy now retries key preparation and, if necessary, drops the packet so that the peer can retransmit it, rather than using missing keys. Delayed packets from the initial key phase are also accepted correctly after the first key update, avoiding unnecessary packet loss and retransmissions on connections with reordered traffic. Error handling after the handshake now cleans up the correct connection identifiers and preserves their numbering for a retry. A small memory leak on token-generation failure has also been fixed. Additional defensive handling for ChaCha20 with AWS-LC is included, although its problematic cleanup path is not currently reachable. * htx: Header length limits are now enforced on updates. A header name is limited to 255 bytes and a header value to 1 MB. These limits were checked when a header was added, but not when an existing one was rewritten with "replace-header" or "replace-value" rules. When exceeded, the length silently overflowed into the block type, corrupting the message. Since the header must first fit in a buffer, only setups with "tune.bufsize" above 1 MB are affected; a client sending a large enough header is then enough to trigger the issue. The same checks are now applied on updates. The issue was reported by Adam Crawford. A 3.4 regression in HTX transfers was also fixed: with L7 retries and small buffers, the end-of-message flag could be lost on the request forwarded to the server, which then waited for more data. Two more HTX fixes were backported as a precaution (zero-sized blocks reservation and a wrong position returned after defragmentation); their only known trigger is the decompression filter which only exists in 3.5-dev, so no released version was affected. The "tune.bufsize" documentation was clarified regarding the 256 MB hard limit and the fact that it applies to request and response headers. * cli: A crash and a buffer overflow on the command line parser were fixed. When a command line exactly filled the input buffer and ended with the payload pattern ("<<"), the payload buffer was allocated with a size of 0, leading to a crash. If payload data then arrived in a subsequent read, a length computation wrapped around and the line was copied past the end of the buffer. Both issues are fixed by never reading into a full buffer. Only users with access to the stats socket could trigger them. Setting "tune.cli.max-payload-size" to 0 was a valid mitigation. In addition, a payload pattern without any command is now rejected with an error instead of being silently ignored. * hlua: A use-after-free in Lua cosockets was fixed. Garbage collection of Lua sockets could release resources from the wrong thread or access resources already freed, potentially crashing a worker. This notably affected scripts loaded with "lua-load", whose state is shared between threads. Socket cleanup is now handed back to the owning thread. Closing a Lua socket that was never connected is also safe. Loading "mailers.lua" with "lua-load-per-thread" no longer fails at startup with "use_native_mailers_config: not available outside of body context". HTTP message duplication consistently returns nil when there is no data to copy. Finally, memory associated with Lua rules is released during configuration teardown; this was not a leak accumulating on each request during normal operation. * http-client/ocsp/acme: Stuck OCSP updates and ACME transactions were fixed. A regression in response reception could block automated OCSP updates and ACME operations whenever a response arrived in more than one part. Instead of receiving the rest, HAProxy waited until the server timeout and the operation failed. Responses are now collected correctly, restoring these certificate-maintenance operations for affected deployments. The same regression could leave the Runtime API's "httpclient --htx" command stuck just after the response headers. It now continues to read and display the response. A possible worker crash during internal HTTP client shutdown has also been fixed. * ssl: TLS session resumption failures and several smaller issues were fixed. With OpenSSL 3.1 or older, resuming a TLS session at the end of its configured lifetime could fail with an internal-error alert instead of falling back to a full handshake. Expired sessions are now discarded correctly, allowing the connection to proceed with a fresh handshake while still respecting "tune.ssl.lifetime". Newer OpenSSL versions were not affected. On 64-bit big-endian systems such as s390x and ppc64, the AES decryption converters and JWE decryption could corrupt memory and crash a worker when processing input. The output-length handling has been corrected. This particular issue does not affect the usual little-endian systems. A small memory leak when deleting CA-file entries has also been fixed. Finally, receiving TLS data when the SSL context is no longer available no longer risks a crash from accessing that missing context. * sample: Strings carrying an embedded NULL byte could bypass ACLs. The "url_dec", "json_query", "jwt_header_query" and "jwt_payload_query" converters could produce a string containing a NUL byte (from "%00", "\u0000" or a base64-decoded JSON). Such a string was then compared by "-m str" on its prefix only, so "/public%00/admin" matched "/public" and an allow-list could be bypassed. These converters now fail on such input, like they already do on invalid sequences. Legitimate URLs and tokens are not affected. Along with this, the configuration manual now describes the exact contents allowed for each sample type. * map: A crash with map_regm inside an ACL was fixed. Using the "map_regm" converter in an ACL applied on a fetch that iterates over several values, such as "req.hdr(name)" without an occurrence number, crashed the process as soon as the first value did not match. The converter was overwriting the internal iteration cursor of the fetch. A single request was enough to trigger it, and the bug has existed since 1.7. The issue was reported by @Michael-JRead. * http rules: capture rules evaluated in the backend context could crash. Capture rules cannot be used on the backend side. However it is possible to have such rules on a listener. In that case, when the listener was used as a backend only, a crash could be experienced or the memory pools could be corrupted because the capture slots were used in the context of a frontend that never referenced them. Since such backend relationship can only be resolved at run time, this could not be detected at startup. The rules are now ignored for requests coming from another frontend, and the documentation was updated to state that these capture slots only exist in the section declaring them. * http-htx: Rewriting the "Host" header of large requests could corrupt them. When a "replace-header" rule rewrites the "Host" header of a request whose URI contains an authority (all HTTP/2 and HTTP/3 requests, and HTTP/1 requests in absolute form), the URI's authority is updated to stay in sync with the new value. This update was performed using on of rotating trash chunk and could overwrite the new host value iteself, corrupting this way the request. The authority update is now performed in a dedicated buffer, so the forwarded request always remains consistent. * http rules: Conditional "normalize-uri" rules could apply the wrong normalizer. When "percent-to-uppercase", "percent-decode-unreserved" or "path-strip-dotdot" was used without its optional argument and directly followed by an "if"/"unless" condition, the rule silently ended up as "path-merge-slashes". Such rules now perform the configured normalization. If you use them, be aware that URIs will now be rewritten as intended, while they were previously left mostly untouched. The issue was fixed by Youngkwang Lee. * tcp rules: "tcp-request content" rules restarted from scratch on yield. A regression introduced in 3.2 made the evaluation of "tcp-request content" rules restart from the first rule each time a rule yielded more than once (for instance while waiting for more data), instead of resuming at the current one. Previous actions could then be re-executed. Evaluation now resumes at the waiting rule, avoiding these repeated actions. * filters: The "filter-sequence" directive was removed. This directive was added in 3.4 to define a different filter order for requests and responses. Several bugs were found in it, and fixing them properly requires a change of syntax and a deeper redesign, which will be done in 3.5. Given its state, it was very unlikely to be used in production, so it was reverted from 3.4. A configuration still containing it will now be rejected at startup; the line must simply be removed. The earlier fix for a startup crash with this directive is superseded by the revert. * mux-h2/mux-spop: Two protocol handling issues were fixed. An H2 stream that only subscribed for sending without actually trying to send data was never woken up again. This could happen with health checks using the PROXY protocol on H2 connections when the handshake was not yet complete, leaving the check stuck until its timeout. These checks now resume correctly once the connection is ready. SPOE connections to agents were rejected when the HELLO frame arrived split across several TCP segments, because the frame header was parsed twice. HELLO and DISCONNECT frames are now correctly reassembled. * task: A race in the destruction of shared tasks was fixed. Destroying a task that could still be scheduled by another thread could lead to the task being run after being freed, with a risk of crash. Such tasks are now killed asynchronously instead, avoiding this race on multithreaded deployments. Other few minor issues were also addressed: * mux-h2: trailers received on a tunneled stream are now rejected. * TLS inspection: Bounds checks in the TLS ClientHello parser were fixed. * cache: An issue about possible hash collisions on the primary key was fixed. * http fetch: "http_auth_bearer" used with a custom header was fixes to work as expected in all cases * http analysis: The tunnel timeout was not applied on streasms with data filters, this was fixed. In addition, two issues with 1xx interim responses were fixed. The transaction status code after early hints is now properly restored to properly deal with internal responses, such as deny rules. And processing of 1xx interim responses in H2 was fixed to not truncate the final responses with no known length. Finally, the "http_fail_cnt" counter was wrongly incremented on error during response forwarding. Only actual server failures are now counted, once each. * log: CBOR-encoded integers and booleans could overflow the log buffer by one byte. This was fixed by reserving the trailing byte for the terminating-null byte. In addition, the "+json" log encoding now always produces valid JSON by escaping all bytes outside the printable range (for instance control characters or non-UTF-8 bytes). * debug: Crashes while dumping streams were fixed. * proxy: Backends inheriting a mode through chained defaults were wrongly rejected. The inherited mode is now recognized, so there is no need to repeat it in each intermediate defaults section. * resolvers: Truncated DNS responses were misclassified. These responses are now classified correctly, making DNS failures easier to diagnose. * checks: HTTP health checks with several "host" headers could get corrupted because an outdated request-line could be used. It is now refreshed after each update. * ring: Not really a bugfix but an improvement. "show events" gets a "-s" flag to sanitize its output. It replaces control and non-ASCII characters with '?' and tabs with spaces. The default output is unchanged so that scripts and the Data Plane API keep receiving the original bytes Finally, two optimizations were backported: * Adding many servers with "add server" without an explicit ID was quadratic because the lowest unused ID was searched from scratch each time. It is now remembered: adding 20,000 servers went from 14.4 seconds to 66 milliseconds in tests. Reported by Tiburce Giroux. * Logging scales better on many-core machines: In glibc, localtime() and gmtime() take a global lock, which severely limited performance on many-core machines as soon as a date was logged ("option httplog" alone lost half of its throughput on 64 cores, and configs using the "ltime"/"utime" converters even more). A small per-thread cache of recent conversions removes this contention. This issue was reported and co-authored by Jinho Kong. Complete changelog (including above entries) : BUG/MAJOR: h3: reject H3 truncated frames BUG/MINOR: h3: reject truncated frames with mandatory payload BUG/MEDIUM: h3: do not block FIN on empty DATA frame BUG/MINOR: h3: handle empty HEADERS frame as specified BUG/MINOR: h3: handle unknown frame type on request stream as specified BUG/MINOR: h3: only increment frame type counter on new header BUG/MAJOR: mux_quic: fix leak on RESET_STREAM reception BUG/MEDIUM: mux_quic: activate timeout on FE init BUG/MEDIUM: mux-spop: Properly handle parsing of split HELLO/DISCONNECT frames BUN/MINOR: hlua: reset hlua_body variable after per-thread files loading BUG/MEDIUM: hlua: Never release a cosocket applet from the GC BUG/MINOR: mux-h1: Return an error on trailers if last chunk is unfinished BUG/MINOR: hlua: Always return nil if there is no data to dup for HTTP messages BUG/MEDIUM: htx: Don't reset flags when source must be preserved during transfer BUG/MEDIUM: cli: Don't parse next command if input buffer is empty BUG/MEDIUM: cli: Don't read a command or payload line into a full buffer BUG/MINOR: cli: Reject payload with no command BUG/MEDIUM: htx: Reserve a block descriptor for zero-sized blocks CLEANUP: stream: Remove an excess newline in the stream dump BUG/MEDIUM: tcp-rules: Don't restart tcp-request content evaluation on yield MAJOR: filters: Revert the filter-sequence directive BUG/MEDIUM: http-client: Don't use the httpclient context if it was released MINOR: http-client: Add an option to not stop the reception of the response BUG/MEDIUM: ssl/ocsp: Set HTTPCLIENT_O_RES_ACCUM option on the http-client BUG/MEDIUM: acme: Set HTTPCLIENT_O_RES_ACCUM option on the http-client MINOR: http-client: Add a function to notify some data were consumed BUG/MEDIUM: http-client/cli: Notify the http-client when the response is consumed BUG/MEDIUM: htx: Fix the position returned by htx_defrag() BUG/MINOR: tools: Don't try to anonymize a NULL string BUG/MAJOR: htx: Check the header/trailer length limits when one is updated BUG/MINOR: ssl: Fix possible null deref on the SSL context in ssl_sock_to_buf() BUG/MINOR: http-client: Convert server timeout ticks when setting it BUG/MINOR: mux-h2: Don't expect more HTX data on 1xx interim responses REG-TESTS: http-messaging: Add a script to test interim responses for H1/H2 BUG/MEDIUM: log: reserve the trailing 0 in CBOR int and bool encoders BUG/MEDIUM: http-htx: don't build the new authority in a rotating trash chunk BUG/MEDIUM: http-act: ignore "capture len" rules evaluated from a backend BUG/MEDIUM: tcp-rules: ignore "capture len" rules evaluated from a backend BUG/MINOR: http-ana: count response body failures only once in http_fail_cnt BUG/MINOR: http-fetch: http_auth_bearer() must not match a missing header BUG/MINOR: http-fetch: fix the space check of http_auth_bearer() BUG/MINOR: mux-h1: only mark C-L and T-E as sent once the header is emitted BUG/MINOR: tcpcheck: refresh the start-line after updating the authority BUG/MINOR: http-ana: restore the transaction status after early hints BUG/MINOR: mux-h2: Reject trailers received on a tunneled stream BUG/MEDIUM: filters: check the filter name before comparing it BUG/MEDIUM: quic: crash on key update phase change after a failed one BUG/MINOR: quic: late packets of the first key phase are dropped MINOR: quic: protect the ChaCha20 header protection context from being freed BUG/MINOR: qpack: encoder and decoder stream data is never consumed BUG/MINOR: qpack: accept a Required Insert Count which cannot be reached BUG/MINOR: quic: delete the wrong CIDs when post-handshake frames fail BUG/MINOR: quic: leak of the NEW_TOKEN frame on token generation failure BUG/MEDIUM: map: do not overwrite the fetch context in pat_match_regm() REGTESTS: map: check map_regm inside an ACL over an iterating fetch BUG/MINOR: sample: reject a \0 byte in url_dec, json_query and jwt_*_query REGTESTS: http-rules: check "-m str" on a sample with an embedded \0 BUG/MINOR: hlua: release private Lua rule data on teardown BUG/MINOR: resolvers: classify empty truncated responses CLEANUP: resolvers: stop clearing the DNS response buffer BUG/MEDIUM: http-ana: apply tunnel timeout with data filters MEDIUM: mux-h1: Harden test for short data at end of stream BUG/MEDIUM: mux-h2: Make sure we remove H2_SF_NOTIFIED on subscribe BUG/MEDIUM: task: Do not destroy a task that is not ours in task_destroy BUG/MINOR: cache: Manage collisions on primary key BUG/MINOR: cache: Seed cache primary hash BUG/MINOR: ssl: don't pass the address of a size_t as an int* to OpenSSL BUG/MINOR: ssl: Fix leak of ca_list in cafile_entry BUG/MINOR: payload: fix the cipher_len bound check in smp_client_hello_parse() BUG/MINOR: payload: bound ClientHello extension lists by the extension length BUG/MEDIUM: ssl: don't set a 0 timeout on an expired TLS session OPTIM: server: remember the lowest known unused server ID MINOR: ring: add "-s" flag to "show events" to sanitize the output REGTESTS: log: add a test for "show events -s" REGTESTS: log: check which log-format tags escape control characters DOC: config: mention that section 8.6 does not apply to the cbor encoding REGTESTS: log: check that the +cbor output passes the logged bytes through DOC: config: clarify tune tune.bufsize doc regarding various limits BUG/MINOR: stream/debug: harden the stream dump function regarding signals DOC: configuration: clarify the validity ranges of sample types BUG/MINOR: proxy: pass PR_FL_DEF_EXPLICIT_MODE through cascaded defaults OPTIM: tools: keep a cache of recent localtime() and gmtime() BUG/MEDIUM: log: encode the whole non-printable range in the +json output REGTESTS: log: check the escaping performed by the +json option BUG/MEDIUM: http_act: fix normalize-uri normalizer selection with a condition 3.4.4 This fixes a lot of issues, and a sizeable share of them were found and reported with the help of AI-based tools/agents (Claude, OpenAI, and a couple of other AI-assisted researchers), which seems to be an efficient way to dig up this kind of corner case, so thanks to everyone involved for the reports. A few areas received more attention than others and are worth upgrading for: - CVE-2026-78120: a TLS session established on one "bind" of an HAProxy process could be resumed on a different "bind" of that same process, regardless of the certificate or the client-certificate verification policy configured on it. With stateful resumption (the shared session cache), this worked between any two binds of the process. With stateless resumption (tickets), it worked between any binds sharing the same tls-ticket-keys, even on a different process. By default, tls-ticket-keys are generated randomly per bind, so this doesn't apply unless the same keys are explicitly shared across binds. In practice this meant a session/ticket obtained on a bind with no client-certificate requirements could be resumed on another bind enforcing strict mutual TLS, without the client ever presenting a certificate on that second connection. Configurations that gate access by checking whether a certificate was actually used, rather than trusting the bind's handshake verification result, were not affected: ssl_c_used correctly reflects certificate usage on the current connection, whether resumed or not. As a mitigation without upgrading, this can be enforced in TCP mode: tcp-request content reject if ! { ssl_c_used } or in HTTP mode: http-request deny if ! { ssl_c_used } Alternatively, the stateful session cache can be disabled entirely, leaving stateless resumption -- whose tls-ticket-keys are randomly generated per bind by default -- as the only resumption mechanism: global tune.ssl.cachesize 0 Note that, independently of this issue, it is good practice to inspect the certificate presented by the client, as explained on the wiki: https://github.com/haproxy/wiki/wiki/mTLS-configuration-in-HAProxy#inspecting-the-client-certificate Three fixes now scope session/ticket resumption to the actual certificate, verification policy and crt-list filter in use. - tune.ssl.lifetime wasn't being enforced across TLS 1.3 session renewals (including on AWS-LC), letting a resumed/renewed session outlive the configured limit. - CVE-2026-78121: qpack_get_varint(), used to decode QPACK-encoded HTTP/3 header fields, could shift a 64-bit value by 63 bits or more when parsing a varint with an excessive number of continuation bytes, which is undefined behavior in C. Impact is low: this was filed as BUG/MINOR since no exploitable consequence beyond the UB itself was identified on the compilers/platforms tested. The shift count is now explicitly bounded before use. - the "sink"/log forwarding code received 4 fixes: a "log tcp@..." line in the global section could crash at boot because its implicit forwarding server was left uninitialized; that same kind of implicit server, in an unrelated gap, also kept max-reuse disabled, causing a new TCP connection to be opened for every single log line instead of reusing it; a lock was needlessly held around ring_dispatch_messages(), which could deadlock. - when a message's body was shorter than its announced Content-Length, the H1 mux still reused the connection and the H2 mux still marked the message as complete, silently forwarding a truncated message and risking confusion with the next request on a reused connection; the H1 mux now closes the connection instead, and the H2 mux no longer marks the message as complete. - the cache code got 3 fixes: an entry could be released while still referenced under the cache read lock, a secondary entry could be retained without its primary one when detaching a row, and a request with a duplicated Origin or Referer header could match a secondary key computed from only the first occurrence, so such requests now bypass the cache instead of risking an unpredictable match. - a handful of correctness fixes: an absolute-form request-target with no path but a query string (e.g. "http://host?token=...";) had its query string swallowed into the authority, corrupting the request on the wire; rewriting a server-side cookie ("cookie ... rewrite" or "prefix") could silently fail to expand and still corrupt the byte following it in the response; a TCP payload filter could lose buffered data if the producer shut its connection while the filter still had pending data to flush; Lua's Channel:send() could resend the same prefix instead of the remainder after a partial write, duplicating data and desynchronizing the stream; HPACK could truncate H2 request methods/schemes longer than 127 bytes, which in practice mostly caused shared backend connections to be aborted with a protocol error under "http-reuse always"; and the "aes_gcm_dec" converter and the JWE AES-GCM key-unwrap path accepted a truncated authentication tag instead of requiring the full 16 bytes, which is now enforced. - a few crash fixes: deleting the backend declared first in the config could crash the process immediately, because it actually sits second in the internal proxy list (right after the internal "GLOBAL" proxy) and its removal was mishandled by an off-by-one in the list walk; "clear counters all" also used to segfault the next request on any server, since it zeroed the shared per-thread-group counters pointers that every hot path dereferences without a NULL check; this also fixes "clear counters all" not actually resetting cumulative counters as documented. Thanks to Alexander Stephan for the patch. On top of this, a new has_ctl() converter was added to detect control characters in a sample, and the long-undocumented "backend" keyword was formally implemented and documented. Upgrading is recommended for everyone running 3.4, especially those relying on client certificate authentication. Complete changelog (including above entries): BUG/MEDIUM: counters: preserve shared.tg pointer on 'clear counters all' BUG/MEDIUM: proxy: fix crash on delete first backend BUG/MINOR: server: check strdup return value on server ID BUG/MINOR: proxy: fix default-server leak on post-parsing cleanup MINOR: proxy: implement unpublished backend keyword DOC: explain better that named defaults are preserved BUG/MINOR: proxy: release watcher in various commands on CLI abort REGTESTS: proxy: complete "del backend" test BUG/MEDIUM: quic: prevent out-of-bound read on wrapping CRYPTO content BUG/MINOR: quic: drop multiple Retry on same connection MINOR: log/tools: fix ambiguous comments for some log encoding helpers BUG/MEDIUM: log: always reserve room for trailing 0 when using CBOR encoding helpers BUG/MEDIUM: lua: resume Channel:send() from the unsent part of the string BUG/MEDIUM: hlua_fcn: ensure systematic bref cleanup for patref list iterator BUG/MINOR: fcgi-app: allow explicit filter declaration with non-cache/non-compression filters BUG/MEDIUM: filter: Disable auto-close on channel during TCP payload filtering BUG/MINOR: flt-http-comp: Don't read next block to detect end of data BUG/MINOR: server: fix off-by-one error when parsing and copying source port range BUG/MINOR: qpack: missing shift count check in qpack_get_varint() (UB) BUG/MINOR: hbuf: treat unexpected escape sequences as literals BUG/MINOR: log: fix double-free error when error in parse_loger occurs BUG/MEDIUM: http: fix authority parsing for absolute-form URI with empty path BUG/MINOR: resolvers: accept fields at the response boundary BUG/MINOR: cli: use the current argument to parse the FD spec in "show fd" BUG/MINOR: cli: do not reject the "/" form of "show fd" BUG/MEDIUM: spoe: clear the applet pointer when the applet fails to start BUG/MINOR: mux-fcgi: don't call fcgi_strm_destroy() on a NULL stream BUG/MEDIUM: http-ana: don't crash on "keep-query" in a response redirect BUG/MEDIUM: stick-tables: use the same bucket for string keys with a NUL BUG/MEDIUM: sock: bound the recvmsg() length when receiving old sockets BUG/MEDIUM: http-ana: check the cookie rewrite result before moving the offsets BUG/MINOR: mux-fcgi: sanitize the STDERR records before logging them BUG/MEDIUM: bwlim: fix a stick-table entry leak in shared mode BUG/MEDIUM: mux-fcgi: check the room left before appending the index BUG/MEDIUM: mux-h1: close the connection on a short content-length MEDIUM: mux-h2: don't report EOM on a short content-length message BUG/MEDIUM: jwe: validate the secret length against the algorithm of the token BUG/MINOR: jwt: don't take an extra reference on the certificate public key BUG/MEDIUM: ssl: require a full-length AEAD tag when decrypting with AES-GCM BUG/MINOR: conn: Do not check 'sess_el' list on frontend connections in __trace_enabled BUG/MINOR: ssl: Fix leak of X509_NAME in traces BUG/MINOR: ssl: release the previous client cert reference at depth > 0 BUG/MEDIUM: ssl: Fix unprotected 'ssl_sock_choose_sni_ctx' calls BUG/MEDIUM: cache: retain the primary or secondary entry only when detaching its row BUG/MEDIUM: cache: do not release an entry under the cache read lock BUG/MINOR: ech: propagate error from load_echkeys() BUG/MINOR: ech: reject an ECH store with no usable private key BUG/MEDIUM: acme: don't delete a NULL token from the map BUG/MINOR: ssl: reject server certificate names containing a NUL byte BUG/MINOR: acme: restrict the permissions of the generated account key DOC: config: clarify req.ssl_sni BUG/MINOR: ssl: reject an embedded NUL in the ssl_*_dn(entry) fetches BUG/MINOR: ssl: reject an embedded NUL in the full-DN ssl_*_dn() fetches BUG/MINOR: payload: fix handshake length off-by-4 in ssl_hello_sni/alpn BUG/MINOR: spoe: check snprintf() return value in spoe_set_var/spoe_unset_var BUG/MEDIUM: ssl: enforce tune.ssl.lifetime across TLS1.3 session renewals BUG/MINOR: ssl: apply tune.ssl.lifetime to TLS1.3 sessions on BoringSSL/AWS-LC BUILD: ssl: disable the TLS1.3 session timeout clamp on wolfSSL BUG/MEDIUM: ssl: isolate TLS session resumption per X509 server certificate BUG/MINOR: ssl: isolate TLS session resumption per crt-list filter BUG/MEDIUM: ssl: isolate TLS session resumption per authentication policy BUG/MINOR: haproxy: fix out-of-scope tmpdir usage in do_chroot() BUG/MINOR: ssl/cli: fix frontend-not-found detection in 'show ssl sni -f' BUG/MINOR: ech: fix label at end of compound statement BUILD: ssl: avoid a potential null-dereference warning on OpenSSL 1.0.2 BUG/MEDIUM: hpack: encode long methods and schemes using the long form BUG/MINOR: stats-file: reject tgid 0 when preloading shm objects BUG/MINOR: hlua: use a local buffer to format the socket addresses DEV: haring: bound the ring geometry to the size of the file BUG/MINOR: connection: reserve the whole CRC32C TLV before saving its pointer BUG/MEDIUM: session: don't release a reversed connection twice on error BUG/MINOR: lb-chash: bound the walk when the saved cursor changed tree BUG/MINOR: debug: only dump the trace once in __BUG_ON_ONCE() BUG/MINOR: mux-h2: strip the userinfo when deriving :authority for a server BUG/MINOR: quic: avoid a division by zero in the BBR pacing interval DOC: security: clarify that only up-to-date versions may get securty reports BUG/MINOR: mux-h2: harden h2_dump_h2s_info() against potentially null h2s->sd BUG/MEDIUM: sink: pre-initialize the implicit log forwarding server BUG/MEDIUM: connection: fix an infinite loop in the fc_pp_tlv() fetch BUG/MEDIUM: sink: do not hold the sft lock around ring_dispatch_messages() DOC: haterm: add a missing 'haterm' build target on an example MINOR: sample: add new converter has_ctl() to detect control characters MINOR: debug: check the match count in __BUG_ON_ONCE() and not in complain() REGTESTS: converters: use connection: close in the has_ctl() test BUG/MEDIUM: cache: ignore cache on redundant origin/referer BUG/MEDIUM: sink: initialize the settings of the implicit log server BUG/MEDIUM: sink: do not create one implicit ring per logger copy BUG/MINOR: wurfl: fix memory leak of information list and patch strings at deinit Signed-off-by: Adolf Belka --- lfs/haproxy | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/haproxy b/lfs/haproxy index 030219275..cf257daba 100644 --- a/lfs/haproxy +++ b/lfs/haproxy @@ -26,7 +26,7 @@ include Config SUMMARY = The Reliable, High Performance TCP/HTTP Load Balancer -VER = 3.4.3 +VER = 3.4.7 # From: https://www.haproxy.org/download/ @@ -36,7 +36,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = haproxy -PAK_VER = 36 +PAK_VER = 37 DEPS = @@ -54,7 +54,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 75e8edf463e1e9a53a17aee51ef5995c800fe8e1bc043bb08aee55eb528b937f382f2488a8c7e155bbe5fad979c268cbc427d9317ef2bc9ac117940e7ac5bdd0 +$(DL_FILE)_BLAKE2 = 3a8fb398ab802a16f57c8a06dfa5e0413336f28d40cb9386b9d5a670aea59fa551cdc08efa15ee0ff8efb238eb11a6c796b34a0cfb331aa6d226ed6bf0ec91e9 install : $(TARGET)